Privacy Policy

1. Data protection at a glance

Personal data is any information relating to an identified or identifiable person. This policy explains what personal data is processed when you visit kivvo.app, use the organizer dashboard or the Kivvo participant app, and what rights you have. Controller for the website and platform accounts: INOVA LAB SHPK, Bulevardi Gjergj Fishta, Shk 2, Nd 146, Ap 19, Kodi Postar 1001, Tiranë, Albania — contact@kivvo.app. For personal data processed inside a customer’s event (see section 4), the event organizer is the controller and we act as processor.

2. Hosting

The Platform — application, PostgreSQL database and uploaded files — is hosted exclusively in the European Union with Hetzner Online GmbH, Germany. When you access the Platform, IP addresses and technical server logs are processed to deliver the service and ensure its security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, reliable service). We use no third-party analytics or tracking services.

3. Accounts and sign-in

Sign-in is passwordless: you enter your email address and receive a one-time code. We process your email address, name and profile details you choose to add, and technical session data. There is no social login and no password to store. Legal basis: Art. 6(1)(b) GDPR (performance of the contract or use of the service).

4. Event participation (organizer as controller)

When you register for an event or use the participant app, the data you provide — including answers to the organizer’s custom registration form, check-in records, attendance, uploaded files and photos, goals, feedback and poll responses — is processed on behalf of the event organizer, who is the controller for it. Our Data Processing Agreement (kivvo.app/dpa) governs this processing. Answers the organizer marks as masked are additionally encrypted at field level. Requests concerning this data are best addressed to your organizer; if you contact us, we forward them without undue delay.

To keep entry check-in working without connectivity at the venue, the app on an organizer’s device may temporarily cache the event’s attendee list (name, attendee code, country, room and check-in status). This cache is stored encrypted at rest using the device’s secure storage (iOS Keychain / Android Keystore), is only available to signed-in organizers of the event, and is replaced or removed when the roster is refreshed, expires automatically after at most 7 days, and is removed when the organizer signs out.

If you choose to add your ticket to Google Wallet or Apple Wallet, a digital pass containing your name, attendee code (the ticket QR), event name, venue and dates is created at your request and stored in your wallet. Passes you save to Google Wallet are processed by Google and linked to your Google account; passes added to Apple Wallet are stored on your device (and in your iCloud backups, where enabled) and processed by Apple. Their respective privacy policies apply to that storage. Removing the pass from your wallet deletes it there; it can be re-created from the app at any time.

5. Payments

Registration payments are processed by Stripe Payments Europe, Ltd., Dublin, Ireland. Payment goes directly from the participant to the organizer; we receive only confirmation details (payment ID, amount, time) — never card data. Legal basis: Art. 6(1)(b) GDPR.

6. Push notifications

The participant app delivers push notifications via Firebase Cloud Messaging (Google Ireland Ltd.; Google LLC, USA, under the EU-US Data Privacy Framework and Standard Contractual Clauses). Our push payloads are content-free by design: they carry a wake-up signal and no personal content — the app fetches the actual content directly from our EU servers. You control notifications in the app and in your device settings. Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Maps

Event locations and the nearby-events map in the participant app are displayed using Google Maps (Google Ireland Ltd.; Google LLC, USA, under the EU-US Data Privacy Framework and Standard Contractual Clauses). When the map is shown, your device retrieves map tiles directly from Google, which processes your device’s IP address and the visible map area for that purpose under the Google Privacy Policy. If you grant location access, your position is shown on the map on your device; we use your location only to search for events near you and do not store it. Legal basis: Art. 6(1)(b) and (f) GDPR.

8. Email

Transactional email — sign-in codes, registration, waitlist and invitation messages — is delivered via Sendinblue SAS (Brevo), France. Your email address and the message content are processed for delivery. Legal basis: Art. 6(1)(b) GDPR.

9. Contact and demo requests

The contact form on kivvo.app collects your name, email address and optionally organization, role, message and the site language you used. We use this data to respond to your request and to prevent misuse, and we retain it only as long as necessary for that purpose or as required by law. Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

10. Cookies and local storage

We use no marketing or tracking cookies and no advertising technology. The Platform stores only what is technically necessary for it to work: your sign-in session and preferences (such as language and date format), kept in your browser’s or device’s local storage. The public website works without cookies; your preferred language is detected from your browser’s language settings.

11. Visibility and social features

Inside an event, other participants see your name and country. Your profile photo is private until you choose to share it, and you control whether others may invite you to chat. Content you post in groups or chats is visible to their members. Organizers can see announcement and official-channel reach and whether you have viewed official messages, but cannot browse your private conversations. If a message is reported, its content is shown to organizers for moderation, and we can access message content where necessary to protect the safety of participants. Private chats are never scanned or analyzed. You can edit or clear your bio, contact links, interests and skills at any time.

12. Your rights

You have the right to access your personal data, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest (Art. 15–21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). You may also lodge a complaint with a supervisory authority. To exercise your rights, contact contact@kivvo.app.

13. Retention

We store personal data only as long as necessary for the purposes described here or as required by law. Event-specific data such as registrations, rosters and schedules is retained for the duration of the event and any statutory retention periods (accounting records typically up to 10 years); afterwards it is deleted or anonymized in accordance with the Data Processing Agreement. Your account-level content — direct messages, connections, personal notes and goals — persists across events for as long as you keep your account, so connections made at an event can continue afterwards. Deleting your account removes your profile and anonymizes your identity in past messages.

14. Data security

We protect personal data with appropriate technical and organizational measures: encryption in transit (TLS) and at rest, field-level encryption for masked form answers, encrypted on-device storage for offline data (such as the organizer check-in cache), EU-only hosting, role-based access with per-participant privacy tiers, and content-free push notifications. These measures are continuously improved.

15. International transfers

Personal data is hosted exclusively within the European Union. Where data is accessed from outside the EU/EEA — including administrative access by our team in Albania or processing by Google’s non-EU affiliates for push delivery — such transfers are safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy mechanism such as the EU-US Data Privacy Framework.